It seems someone or something is replicating my requets

Question

I have a personal service which is deployed on one VPS. The service works based on http requests, and it is due specific goal and handling three types of requests.

The order matters in the requests. Client send requests, it usually takes something between 30s to 6min to get a response (and it's OK).

When I set it to perform short task (30-60 seconds) everything is OK. But when I have longer request (3-4 minutes), it seems someone with another IP replicates the requests I sent after 2(almost) minutes.

Times are in seconds:

1. at time 0 I send a request to startup the system from IP1 (my IP)
2. at time 15 I send a request to run the system from IP1 (my IP)
3. at time 18 I send a request and ask for the result which should take about 500 seconds from IP1 4. at time 130 the system gets a request from another IP (IP2) to startup the system
4. at time 154 the system get a request to run the system from IP2

I checked IP2. It's not on any sort of black list, and it seemed to come from Amazon AWS.

My mistake was that I have left the port open and made it possible. I closed it and now I'm using ssh port forwarding. It works fine now. What I don't understand is: "is this something normal? Is this some sort of attack? Am I paranoid?"

Answer 1

Your scenario is not described completely and is difficult to understand what is the issue, however you can do the next checks:

• Your application should use TLS, so all your requests will be encrypted over the internet, is your application using HTTP?
• You should review your application, according your explanation this could be a bug in your application. You should provide more information about it.
• On the destination host, you could pcap file the requests and later try to discover what is the issue and where the other IP came from.

Hope it helps